high7.5Public exploit code
CVE-2009-4437
Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wish…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Active Auction House 3.6 - Blind SQL Injection2009-12-17 · webapps · asp · Verified
Impact
Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Activewebsoftwares | Active Auction House | Version 3.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt
- http://secunia.com/advisories/14839
- http://www.exploit-db.com/exploits/10520
- http://www.securityfocus.com/bid/37401
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54891
- http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt
- http://secunia.com/advisories/14839
- http://www.exploit-db.com/exploits/10520
- http://www.securityfocus.com/bid/37401
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54891